SEFAUTIL and Lync 2013 Call Pickup Group Tool Permissions

I have had some enquiries from people about issues that they have been having with SEFAUtil  (ie. the Call Forwarding and Group Call Pickup tool from the Lync ResKit). Many of these questions have been about getting no response from SEFAUTIL after running a command. This can be for a few reasons, some of which may have to do with permissions, others to do with configuration. So in this post we’re going to go through the requirements and permissions needed for SEFAUtil as well as the permissions needed for running the Lync 2013 Call Pickup Group Manager. Before we go any further, some background; SEFAUTIL was designed to be run on a server that has Lync server components installed on it. As Jens Trier’s blog post on the tool points out, even if you want to run SEFAUTIL on a separate machine, it still needs to have Lync server base components installed. So it makes sense to choose to run the SEFAUtil on an Front End Server.

How can we run SEFAUtil and the Call Pickup Manger on a server and only give a user accessing it minimum permissions? Well, as we all (may or may not) know, the Lync RBAC role permissions (ie. the Active Directory security groups starting with the prefix “Cs”, example “CsAdministrator”) do not apply to someone that is logged directly into a Lync server. These roles only restrict access to users that are either connecting via Lync Control Panel, or via remote Powershell connection via the “OcsPowershell” webservice that runs on the Front End. When you’re logged into the Lync server directly there are some Active Directory permissions that will affect your ability to access the backend SQL database which will stop you from running some commands. These SQL permissions are tied back to the Active Directory security groups that start with the “RTC” prefix. So, in short, these permissions can still affect a user's ability to access some commands/functions when logged directly into a Lync server.

The SEFAUtil tool documentation doesn't contain any details about what rights are required to use it. However, from testing in the lab I have concluded that you need to be logged in as a user with a minimum of “RTCUniversalReadOnlyAdmins” rights for it to work. Example:

In case you were also wondering which other permissions work for SEFAUTIL, here’s a list:

Permission	SEFAUTIL Works?
RTCUniversalReadOnlyAdmins	Yes
RTCUniversalUserAdmins	Yes
RTCHSUniversalServices	Yes
RTCUniversalSBATechnicians	Yes
RTCSBAUniversalServices	Yes
RTCUniversalServerAdmins	No
RTCUniversalServerReadOnlyGroup	No
RTCUniversalGlobalReadOnlyGroup	No
RTCUniversalUserReadOnlyGroup	No
RTCComponentUniversalServices	No
RTCProxyUniversalServices	No
RTCUniversalConfigReplicator	No
RTCUniversalGlobalWriteGroup	No

Note: These results are from lab testing. If you see any different results in the field, let me know.

Lync 2013 Call Pickup Manager Permissions

As I mentioned earlier, the Call Pickup Manager Tool also needs to query SQL in order to get information about users in the database (this allows for quick retrieval of current user settings). It does this by making direct SQL SELECT calls to the RTCLOCAL databases on each Front End server. When you run the tool you may find that you receive an error that looks like this:

Error running SQL on 2013ENTFE004.domain.com : The SELECT permission was denied on the object 'Resource', database 'rtc', schema 'dbo'.

This error is caused by the user not having sufficient rights to make direct SQL SELECT calls on the database. If you were logged in with Domain Admin rights you would not receive this error, as you would have sufficient permissions on the database (however, not everyone can be given Domain Admin permissions!).

To get around this issue we will need to allow permissions for specific users to be able to make SELECT (read only) calls on the “rtc” database. The simplest way to do this is to Grant “select” permissions to the “RTC Local Read Only Administrators” user within SQL for the “rtc” database. The “RTC Local Read Only Administrators” local machine user maps back to the “RTCUniversalReadOnlyAdmins” security group within Active Directory. So any user that you add to the “RTCUniversalReadOnlyAdmins” will have permission to run SQL SELECT commands on the database. This also works well, as SEFAUtil also requires a minimum of “RTCUniversalReadOnlyAdmins” group permissions to work, so it is a good choice for allowing permissions on the database as well.

Granting SQL Permissions on Tables Example

To be as restrictive as possible, we can grant “Select” permissions only on the tables that the Call Pickup Manager tool needs to read in order to work. The two databases that the Call Pickup Manager Tool needs access to are the dbo.Resources and dbo.PublishedStaticInstance tables. The steps below walk you through applying these permissions:

STEP1: Open SQL Management Studio (you will need to have installed this on a machine to access the database).

STEP 2: From the Object explorer, open the “Databases”->”rtc”->”Tables” tree.

STEP 3:  Right Click on the PublicStaticInstance table, and select Properties

STEP 4: On the Permissions page, click on the Search button:

STEP 5: Click on the Browse Button. Then select the “RTC Local Read Only Administrators” user:

STEP 6: Click OK. You should see the User in the object list:

STEP 7: Now the "RTC Local Read Only Administrators" user will appear in the Users and Roles list. Click on it and Grant it “select” permissions:

STEP 8: Do the same process to give select permission on the “resources” table (STEP 1 - STEP 7):

If you would prefer not to do this manually I’ve also prepared a Powershell script that you could use to speed up the process:

Download SQL PermissionsScript:

1.00 Initial Release:

• This script will give RTCUniversalReadOnlyAdmins SELECT permissions on all the Lync Front End Servers RTC PublishedStaticInstance and Resource database tables.
• Run the script from a Lync server with a user account that has sufficient permissions to make changes to the "rtc" SQL database.
• This script is designed to give the minimum required permissions to the database for a user to use the Call Pickup Group Manager tool.
• Ensure that you have opened the Firewall ports for the RTCLOCAL database using the "OpenSQLPortsForCallPickupManager1.00.ps1" script before trying to running this permissions script. If you haven't opened the firewall you will get connection errors when you try and run this script.

SEFAUtil Error Debugging

By default, SEFAUtil does not give you any feedback as to why the tool is not working: when it hits an exception it will stop executing with no error message. However, after doing a bit of detective work, I discovered that SEFAUtil actually has an undocumented “verbose” flag that can be used to help debug why SEFAUtil is not working (this is now baked into the Call Pickup Group ManagerTool version 1.02). Below are two examples of common issues that you might see with SEFAUtil not working: 

User Running SEFAUtil Does Not Have Correct Permissions: 

If the user logged into the Lync Server does not have the correct permissions (ie. one of the “RTC” group permissions I talked about earlier) they will get an error reported in the shell window like this one:

PS C:\Program Files\Microsoft Lync Server 2013\ResKit> .\sefautil.exe /server:melbfepool.domain.com holly.hunt@domain.com /verbose

Starting CollabPlatform...

Microsoft.Rtc.Collaboration.ProvisioningFailureException:One or more values in the configured settings are invalid or unusable. Check inner exception and logs for more details. ---> Microsoft.Rtc.Internal.ServerConfiguration.SettingsInitializationException: The settings wrapper failed to initialize.

Unable to find  the Sqld database: Cannot open database "xds" requested by the login. The login failed.

Login failed for user '2013ENT\testadmin'.

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings.InitConsumerWithRole

(RoleName role)

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings..ctor(String applicationId, SettingsWrapperOptions options)

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings.Get(String applicationId, SettingsWrapperOptions options)

   at Microsoft.Rtc.Collaboration.ProvisioningSourceImpl.GetInitialPlatformData()

--- End of inner exception stack trace ---

   at Microsoft.Rtc.Signaling.SipAsyncResult`1.ThrowIfFailed()

   at Microsoft.Rtc.Signaling.Helper.EndAsyncOperation[T](Object owner, IAsyncResult result)

   at SEFAUtil.SefaTool.Execute()

Detected at System.Environment.GetStackTrace(Exception e, Boolean needFileInfo)

   at System.Environment.get_StackTrace()

   at Microsoft.Rtc.Collaboration.ProvisioningFailureException..ctor(String message, Exception innerException, ProvisioningFailureReason failureReason)

   at Microsoft.Rtc.Collaboration.ProvisioningSourceImpl.GetInitialPlatformData()

   at Microsoft.Rtc.Collaboration.ProvisioningSourceGetInitialPlatformDataAsyncResult.ProcessCoreHelper()

   at Microsoft.Rtc.Collaboration.SipCollaborationAsyncResult.ProcessCore()

   at Microsoft.Rtc.Signaling.AsyncWorkitemQueue.ProcessItems()

   at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessing()

   at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessingCallback(Object state)

   at Microsoft.Rtc.Signaling.QueueWorkItemState.ExecuteWrappedMethod(WaitCallback method, Object state)

   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   at System.Threading.ThreadPoolWorkQueue.Dispatch()

FailureReason = 2

SEFAUtil Trusted Application Not Configured Properly:

If the Trusted Application has not been configured correctly in Lync you will get an error like the one below:

PS C:\Program Files\Microsoft Lync Server 2013\ResKit> .\sefautil.exe /server:melbfepool.domain.com holly.hunt@domain.com /verbose

Starting CollabPlatform...

Microsoft.Rtc.Collaboration.ProvisioningFailureException:One or more values in the configured settings are invalid or unusable. Check inner exception and logs for more details. ---> Microsoft.Rtc.Internal.ServerConfiguration.SettingsInitializationException: The settings wrapper failed to initialize.

The ExternalServer service is not installed on the machine.

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings.InitConsumerWithRole

(RoleName role)

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings..ctor(String applicationId, SettingsWrapperOptions options)

   at Microsoft.Rtc.Internal.ServerConfiguration.UCSettings.Get(String applicationId, SettingsWrapperOptions options)

   at Microsoft.Rtc.Collaboration.ProvisioningSourceImpl.GetInitialPlatformData()

--- End of inner exception stack trace ---

   at Microsoft.Rtc.Signaling.SipAsyncResult`1.ThrowIfFailed()

   at Microsoft.Rtc.Signaling.Helper.EndAsyncOperation[T](Object owner, IAsyncResult result)

   at SEFAUtil.SefaTool.Execute()

Detected at System.Environment.GetStackTrace(Exception e, Boolean needFileInfo)

   at System.Environment.get_StackTrace()

   at Microsoft.Rtc.Collaboration.ProvisioningFailureException..ctor(String message, Exception innerException, ProvisioningFailureReason failureReason)

   at Microsoft.Rtc.Collaboration.ProvisioningSourceImpl.GetInitialPlatformData()

   at Microsoft.Rtc.Collaboration.ProvisioningSourceGetInitialPlatformDataAsyncResult.ProcessCoreHelper()

   at Microsoft.Rtc.Collaboration.SipCollaborationAsyncResult.ProcessCore()

   at Microsoft.Rtc.Signaling.AsyncWorkitemQueue.ProcessItems()

   at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessing()

   at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessingCallback(Object state)

   at Microsoft.Rtc.Signaling.QueueWorkItemState.ExecuteWrappedMethod(WaitCallba

ck method, Object state)

   at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

   at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)

   at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()

   at System.Threading.ThreadPoolWorkQueue.Dispatch()

FailureReason = 2

The Wrap Up

“Permissions, Permissions everywhere, nor any lock to Lync.” - Samuel Taylor Lyncridge 

So anyway, that may have been slightly long winded, however, hopefully it was edu-taining for you all. In a nutshell you just need to put the user in the “RTCUniversalReadOnlyAdmins” security group, and add the SELECT permissions on the database. After that, you should be about to access SEFAUtil and the Lync Call Pickup Group Manager. 

Read more →

Lync Edge Testing Suite (Part 2) – Lync DNS Tester and IP Route Editor Tools

I am dedicating this post to the saying “measure twice, cut once”, as this saying is most apt when describing what you should do before deploying your Edge server. In addition to this, I will be bringing you, not one, but two new Powershell tools to help with your Lync Edge server deployments! In this post we are going to cover two areas of Lync Edge Server deployment. The first is Domain Name records and the second is IP Networking.

For Part 1 of the Lync Edge Suite series go here.

Lync DNS Naming

Domain Name records in Lync can be rather confusing, as over the various incarnations of Lync there have been many different clients and server functions that have required a variety of special DNS records to function. Here are two very useful Technet links for a detailed explanation of how internal and external DNS records work with Lync 2013:

• Lync internal DNS records example Technet
• Edge Server DNS records on Technet

In summary, there are many different records that have been added for various clients and features for Lync to function. So you should always check that all of your DNS records are configured in production. I've made a Powershell tool that may be useful in checking these records are configured.

Lync DNS Tester Tool

 Features

• Make DNS requests to the server of your choice. The DNS server setting will specify the DNS server to make the request to. This means you can test your internal records on your internal DNS server, and your external records on a public DNS server.
• Auto-fill common Lync DNS record names with the “Fill All” button. Tick the “Internal” or “External” checkboxes to select the records you would like to fill. You can even edit the variables at the start of the script to match your standard naming convention.
• IPv6 support for Fill All. Tick the IPv6 box to fill with Quad-A records.
• Can add your own A, AAAA, CNAME and SRV records.
• Save yourself from getting RSI from typing all these nslookup commands manually!

Download Version 1.00(Lync DNS Tester Tool):

External Records

Lync's external DNS records all resolve to either the Edge server(s) or the External Reverse Proxy server for web service connections. The table below shows the records that the Lync DNS Tester Tool will auto fill when the “Fill All” button is pressed and the "External" check box is ticked:

Record Purpose	DNS Name	Host	Fixed / Variable
External Access name	sip.<domain name>	Access Edge IP	Variable (Topology Builder)
External Audio/Video name	av.<domain name>	AV Edge IP	Variable (Topology Builder)
External Web Conferencing name	webconf.<domain name>	Web Conf Edge IP	Variable (Topology Builder)
External Web Services name / Reverse Proxy	lyncwebext.<domain name>	Reverse Proxy	Variable (Topology Builder)
Dial-in simple name / Reverse Proxy	dialin.<domain name>	Reverse Proxy	Variable (Topology Builder)
Meet simple name / Reverse Proxy	meet.<domain name>	Reverse Proxy	Variable (Topology Builder)
External Web Apps Server / Reverse Proxy	waswebext.<domain name>	Reverse Proxy	Variable (Web Apps Server)
Lync discover record for Mobile and Windows 8 App Store client. Technet	lyncdiscover.<domain name>	Reverse Proxy	Fixed
External SIP record. (not a mandatory record, however, it’s in the client lookup list)	sipexternal.<domain name>	Access Edge IP	Fixed
External SRV record for SIP connection	_sip._tls.<domain name>	Access Edge Port 443	Fixed
External Federation SRV record for Open Federation	_sipfederationtls._tcp.<domain name>	Access Edge Port 5061	Fixed
External XMPP Federation SRV record	_xmpp-server._tcp.<domain name>	Access Edge Port 5269	Fixed

For the DNS names in the table that are marked as Variable, there are variables at the start of the script that can be edited to match the configuration of your environment, for example:

# External DNS Name Variables - Edit these to whatever you are using for your Lync environment

$sip = "sip"                  # External Access Edge

$av = "av"                    # External AV Edge

$webconf = "webconf"          # External Web Conf

$lyncwebext = "lyncwebext"    # Lync External Web Services / Reverse Proxy

$dialin = "dialin"            # dialin conferencing name

$meet = "meet"                # meet conferencing name

$waswebext = "waswebext"      # Web Apps server external name

Internal Records

If you tick the “Internal” check box and click the “Fill All” button, the following records will be added to the list box:

Record Purpose	DNS Name	Host	Fixed / Variable
Dial-in simple record internal	dialin.<domain name>	Lync Front End Server or Web Load Balancer	Variable (Topology Builder)
Meeting simple record internal	meet.<domain name>	Lync Front End Server or Web Load Balancer	Variable (Topology Builder)
Lync web services external record. Required for internal Mobile clients. Technet	lyncwebext.<domain name>	External Reverse Proxy	Variable (Topology Builder)
Office Web Apps farm internal name	wasweb.<domain name>	Office Web Apps Server	Variable (Web Apps Server)
Admin console simple name	admin.<domain name>	Front End Server or Web Load Balancer	Variable (Topology Builder)
SIP record. Required for Lync Phone Edition, or automatic logon of clients without DNS SRV records, and for strict domain matching. Not required in all cases.	sip.<domain name>	Lync Front End Server(s)	Fixed
Internal SIP record. (not a mandatory record, however, it’s in the client lookup list)	sipinternal.<domain name>	Lync Front End Server(s)	Fixed
Lync Discover Internal - Mobile and Windows 8 App Store client. Technet	lyncdiscoverinternal.<domain name>	Front End Server or Web Load Balancer	Fixed
SIP internal SRV record	_sipinternaltls._tcp.<domain name>	Front End Server(s) Port 5061	Fixed

For the DNS names in the Internal table that are marked as Variable, there are variables at the start of the script that can be edited to match the configuration of your environment, for example:

# Internal DNS Name Variables - Edit these to whatever you are using for your Lync environment

$wasweb = "wasweb"            # Internal Web Apps Server

$admin = "admin"              # Lync administrator web access

Note: The dialin, meet, and waswebext records will be the same for both Internal and External records. The settings for these names are made in the External settings. For a non-split brain DNS scenario you will either need to deploy Pin Point records, or an internal zone for the external domain name.

In addition to the tables above, you must also remember to check that your Lync Edge server(s) hostname/pool name has been added manually to the internal DNS server. These records are not automatically populated in DNS because Edge servers are not a domain joined machines, and will not automatically get added through Active Directory DNS integration. This is also the case with Lync Front End Pool names, so if you have added a new Front End pool to your topology you should always check that the DNS records have been added to the Internal DNS server manually.

Edge Server Networking

Edge server networking is also an important part of an Edge server deployment. An Edge server is a multi-network interface machine, which means that it needs to make decisions on which interface it will route packets out of when making connections to other machines. In nearly all cases (unless you only have limited external subnets connecting to your Edge) you will make your external Edge interface the owner of the default gateway address (0.0.0.0) and you’ll individually specify your internal subnets using static routes.

Example:

Below is a simple example of an Edge environment with an Internal and External interface:

Network	Net Mask	Next Hop	Interface
0.0.0.0 (Default Route)	0.0.0.0	210.10.10.17	210.10.10.18
192.168.5.0	255.255.255.0	192.168.1.1	192.168.1.2
192.168.6.0	255.255.255.0	192.168.1.1	192.168.1.2
192.168.7.0	255.255.255.0	192.168.1.1	192.168.1.2

For the Default route, you simply edit the Default Gateway within the External Interface within the Adapter settings in the Windows Control Panel, for example:

To set the other static routes within the server you usually use Command Line tools. However, rather than having to remember the syntax in the rare occasions that you have to do this, I decided to make a GUI tool to make this process a little easier.

IP Route Editor Tool

 Features

• List all routes on server.
• Add persistent routes.
• Delete persistent routes.
• Routes are colour coded in order of importance. (Grey = Localhost, Black = Broadcast, Green = Static Routes)
• Routes can be added with or without specifying Interface value. If the Interface value is not set then the server will automatically associate the route to the interface that is on the same subnet as the Next Hop IP Address.

Simply enter the Network, Net Mask, Next Hop, and Interface (note that it's not necessary to enter the Interface if you'd prefer not to, as the machine can figure this out based on the Next Hop address), and press the Add button. Hopefully this one will be pretty straight forward for you to use!

Update (5/9/2014)

1.01 Update:

• Updated to now run on Powershell 2.0
• Script is now signed

1.02 Update (Additional user input validation added):

• Updated the Regex check on the IP Address fields to better police against people accidentally putting bitmasks (ie. /23) after IP Addresses. This previously would result an incorrect route table entry because the route command would do strange things with this input.
• In previous versions the network IP Address was not policed to check that it was the actual network address based on the mask supplied (ie. not a host address). The result was the (non-network) host IP being input into the Route command and it not showing up in the Current Route Table. The network mask setting is now ANDed with the subnet mask to ensure that a real network address is being input.
• In previous versions the Next Hop address was not policed to check that it was on a locally connected network. The result was that the Route command would accept the input even though it was incorrect and add it to the route list. This bad route once entered was also not displayed in the Current Route Table. In this version the Next Hop IP address supplied by the user is first checked to see that it is on a directly connected network before the command Route ADD command is run. An error will also be displayed if the Next Hop is not on a locally connected network.
• Made the form resizeable.

Download Version 1.02 (IP Route Editor Tool):

The Wrap Up

Well, there you go, two more tools for your Lync Edge deployment kit bag. I hope you enjoy them, and get some use out of them. Like always, if you find any bugs or issues with the tools, please report them back to me and if I can reproduce them I will fix them.

Read more →